Privacy Policy — FirmhubAxis

Definitions

This section defines the terms used in this Privacy Policy to provide clarity about the scope of data processing activities carried out by FirmhubAxis in connection with legal services for enterprises and related web services.

Purposes of Processing

We process personal data to fulfill professional obligations to clients, to administer engagements, to meet legal and regulatory requirements, and to operate our website and business systems in a secure and accountable manner.

• To evaluate and accept client engagements, conduct conflict checks and perform client due diligence required for the provision of legal services.
• To provide legal advice, draft and review agreements, manage transactions and represent clients in regulatory or dispute contexts as instructed.
• To communicate with clients, opposing parties, co-counsel and third-party service providers about matters, updates and administrative details.
• To administer billing, invoicing and accounting records related to professional fees and disbursements for client engagements.
• To meet regulatory, statutory or court-ordered obligations that require us to disclose or retain certain information.
• To operate, secure and improve our website, client portal and internal systems, including analytics and quality control activities.
• To respond to legal requests, defend our legal rights and contribute potential breaches or fraudulent activity affecting our operations or clients.
• To manage relationships with prospective clients, including communications related to engagement proposals and initial consultations.
• To comply with anti-funds laundering, sanctions screening and other regulatory compliance processes applicable to legal service providers.

Legal Bases for Processing

We rely on appropriate legal bases to process personal data, including performance of a contract, compliance with legal obligations, legitimate interests, and where relevant, consent for specific processing activities.

• Performance of a contract: processing necessary to provide legal services that a client has requested or to take steps at a client’s request prior to entering an engagement.
• Legal obligation: processing required to comply with statutory duties, regulatory requirements, court orders, or reporting obligations applicable to legal practice in Canada.
• Legitimate interests: processing for FirmhubAxis operational needs such as fraud prevention, network and information security, conflict checks and business administration, balanced against the rights of individuals.
• Consent: where special categories of information or marketing communications are involved and consent is obtained in a specific, informed manner.
• Vital interests or public interest: where limited additional processing is necessary to protect vital legal or public interests, particularly in regulatory or safety-related circumstances.

Relevant International Principles

Although our operations are Canada-focused, we adopt internationally recognized data protection principles to guide processing of personal data when cross-border transfers or international clients are involved. These principles inform transparency and rights handling.

• Lawfulness, fairness and transparency: we process personal data using lawful bases and provide clear information about those activities.
• Purpose limitation: personal data is collected for specified, explicit and legitimate purposes and is not further processed in a manner incompatible with those purposes.
• Data minimization: we limit data collection to what is adequate, relevant and necessary for the stated purposes.
• Accuracy: we take reasonable steps to keep personal data accurate and up to date in the context of legal representation.
• Storage limitation: personal data is retained for no longer than necessary for the purposes described, taking into account legal and regulatory retention requirements.
• Integrity and confidentiality: personal data is processed in a manner that ensures appropriate security including protection against unauthorized or unlawful processing.
• Accountability: FirmhubAxis maintains records and policies demonstrating adherence to these principles and responds to reasonable data subject requests.

Cookies and Similar Technologies

We use cookies and similar technologies to support site operation, basic analytics and user preferences. Cookies that are not strictly necessary will be used only after appropriate notice and, where required, consent by the user.

Types of cookies used include essential session cookies for secure access, performance cookies for aggregated analytics, and functional cookies to remember user preferences. We do not use cookies for profiling beyond anonymous analytics without consent.

Cookie categories: essential (site functionality and security), analytics (usage measurement), and preferences (language and display settings). Third-party cookies used by analytics providers may collect anonymized usage information.

Users can manage cookies via browser settings and opt-out controls provided by certain analytics providers. Disabling non-essential cookies may limit some website functionality but will not affect core service access for client communications.

For a detailed list of cookies and their purposes, consult our Cookie Policy available on the FirmhubAxis website or contact our privacy team for specifics.

Data Sharing and Disclosure

FirmhubAxis shares personal data only as necessary to provide legal services, comply with legal obligations, or to operate the business. Third-party recipients are selected and contractually obligated to apply adequate safeguards to protect personal information.

• Service providers and processors: secure cloud hosts, document management systems, payment processors and secure communication platforms engaged under written agreements limiting use to specified purposes.
• Legal and regulatory authorities: disclosures as required by law, court orders, or to respond to lawful requests from regulators and public authorities.
• Professional advisors and external counsel: when collaborating on a matter, we may share relevant information with co-counsel, expert witnesses or consultants under confidentiality obligations.
• Counterparties and transactional partners: where necessary for negotiation or execution of agreements and with appropriate confidentiality protections.
• Acquirers or business successors: in the event of a sale, merger, or reorganization, personal data may be transferred as part of the transaction subject to privacy protections.
• Aggregated or anonymized data: information stripped of identifiers may be shared for research, reporting or operational purposes without identifying individuals.
• Other disclosures with consent: where we obtain a client's informed consent to share specific data with third parties for particular purposes.

International Transfers

Where personal data is transferred outside Canada, FirmhubAxis applies contractual and technical safeguards appropriate to the jurisdiction and the sensitivity of the data. Transfers are limited to trusted recipients who provide adequate levels of protection through contractual clauses or other lawful mechanisms.

Safeguards include standard contractual clauses, data processing agreements with specific security requirements, careful selection of providers with strong security certifications, and limited transfer of only the data necessary for the purpose.

Data Retention

Retention periods are based on the nature of the data, the purposes for which it was collected, and legal or regulatory retention obligations applicable to legal service providers in Canada. We retain client matter files and associated records for commercially and legally appropriate durations.

Account and engagement records: retained for a period consistent with professional standards and applicable statutory limitations, typically several years after matter closure to allow for potential follow-up and regulatory review.

Communications and correspondence: retained in matter files while the matter is active and thereafter for a period aligned with file retention policies and legal requirements, unless a different retention schedule is required.

Technical logs and security records: retained for a limited period to support security monitoring, incident response and operational analysis in accordance with internal policies.

Deletion and anonymization: when data is no longer required for the stated purposes and no legal retention requirement applies, we delete or irreversibly anonymize the data in a secure manner.

Security Measures

FirmhubAxis applies a layered approach to security proportional to the sensitivity of client information. Security measures include administrative controls, technical safeguards and physical protections designed to limit access, detect misuse, and reduce the risk of unauthorized disclosure or loss.

• Administrative measures: role-based access controls, staff training on data protection and confidentiality, background screening of personnel with access to client information.
• Technical measures: encryption of data at rest and in transit, multi-factor authentication for privileged access, intrusion detection systems and regular vulnerability assessments.
• Operational measures: secure document handling procedures, secure file transfer solutions for client materials, and defined incident response and breach notification processes.
• Physical measures: controlled office access, secure storage of physical files, and measures to protect devices that store client information.

Your Rights

Individuals whose personal data we process have certain rights to access and manage their information. Requests should be submitted with sufficient detail to allow us to locate the relevant records. We will respond in accordance with applicable laws and professional obligations, balancing rights with confidentiality duties owed to clients.

• Right of access — you may request confirmation of whether FirmhubAxis processes your personal information and request a copy of the personal information we hold about you.
• Right to correction — you may ask us to correct or update inaccurate or incomplete personal information relating to you.
• Right to deletion — you may request deletion of personal information where retention is no longer necessary for the purposes described in this policy, subject to legal and regulatory retention obligations.
• Right to portability — where technically feasible, you may request a copy of personal information you provided to FirmhubAxis in a structured, commonly used, machine-readable format.
• Right to restrict processing — you may request restrictions on processing in certain circumstances, for example while you contest accuracy or if processing is unlawful.
• Right to object to processing — you may object to processing based on legitimate interests or for direct marketing purposes; we will assess each request in line with applicable law.
• Right to withdraw consent — where processing is based on consent, you may withdraw consent at any time without affecting processing already carried out on the basis of that consent.
• Right to lodge a complaint — if you believe FirmhubAxis has not complied with applicable privacy laws, you may contact our team or file a complaint with the Office of the Privacy Commissioner of Canada.
• Right to be informed — you have the right to clear information about how and why we collect and use personal information, including any third parties with whom we share data.

Exercising your privacy rights

To exercise any privacy right, contact our privacy team with a clear description of your request and sufficient information to verify your identity. Include your full name, company name (if applicable), and Business ID 309404755 where relevant. Reasonable verification may be required before we release or modify personal information to protect individuals and comply with legal obligations. Requests can be submitted in writing to our address or via the contact details below.

[email protected]

We strive to acknowledge receipt of valid requests within 5 business days and to respond substantively within 30 calendar days. Complex requests may require additional time; if so, we will inform you of the expected timeline and any applicable next steps.